Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
CDE reported an L2 adapter arrival Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	145	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:37:29 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	144	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:37:29 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter removal Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1010	0		4	0	0	-9223372036854775776	143	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:37:29 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter removal Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1027	0		4	0	0	-9223372036854775776	142	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:37:29 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	141	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:32 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {E665B6D9-732A-4205-87C0-C2B0505CFD0A} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	140	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {E665B6D9-732A-4205-87C0-C2B0505CFD0A} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	139	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	138	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2164	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	137	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	136	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2164	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	135	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2188	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	134	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2144	2164	n-h1-771362-3	S-1-5-19	1/25/2021 7:33:22 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	133	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1968	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:32:52 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	132	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1968	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:32:52 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	131	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1968	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:32:52 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4}, f5c01c46-7ff8-48a4-b6cc-6ed38c7bf1e4, 1 1: {E665B6D9-732A-4205-87C0-C2B0505CFD0A}, e665b6d9-732a-4205-87c0-c2b0505cfd0a, 1 2: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1 3: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	130	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1964	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	129	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1964	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {F5C01C46-7FF8-48A4-B6CC-6ED38C7BF1E4} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	128	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1964	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {E665B6D9-732A-4205-87C0-C2B0505CFD0A}, e665b6d9-732a-4205-87c0-c2b0505cfd0a, 1 1: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1 2: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	127	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1964	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	126	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1904	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {E665B6D9-732A-4205-87C0-C2B0505CFD0A} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	125	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1964	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	124	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1904	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {E665B6D9-732A-4205-87C0-C2B0505CFD0A} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	123	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1964	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	122	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1884	1904	WIN-5T344G8GM1H	S-1-5-19	1/25/2021 7:31:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	121	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1892	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:13 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	120	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1892	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:13 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	119	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1892	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:13 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	118	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:12 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	117	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:33 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	116	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	115	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1792	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	114	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1792	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	113	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	112	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	111	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1792	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:29 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	110	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1640	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	109	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1640	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	108	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1640	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	107	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:40:27 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	106	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:19 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	105	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	104	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1604	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	103	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	102	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	101	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1604	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	100	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1604	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	99	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1556	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	98	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1556	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	97	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1556	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	96	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1492	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	95	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1540	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	94	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1540	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	93	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1492	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	92	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1492	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	91	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1692	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:23 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	90	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1692	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:23 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	89	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1692	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:23 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	88	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:19 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	87	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:05 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	86	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:03 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	85	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1528	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	84	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	83	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	82	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1528	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	81	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1528	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	80	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	79	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	78	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	77	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	76	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	75	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter removal Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1010	0		4	0	0	-9223372036854775776	74	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:16 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter removal Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1027	0		4	0	0	-9223372036854775776	73	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:16 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	72	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	71	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	70	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1620	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	69	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1620	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	68	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	67	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	66	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1620	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	65	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1700	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	64	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1700	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	63	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1700	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	62	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:39 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	61	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:56 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	60	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	59	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	58	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	57	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	56	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	55	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	54	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1452	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:49:46 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	53	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1452	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:49:46 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	52	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1452	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:49:46 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	51	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:45:56 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	50	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:01 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	49	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1 1: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	48	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:57 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	47	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:57 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	46	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:57 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	45	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1388	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	44	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1388	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	43	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1388	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	42	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1712	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:39 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	41	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1712	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:39 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	40	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1712	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:39 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	39	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:38 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	38	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:02 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	37	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:01 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	36	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1620	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	35	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	34	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	33	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1620	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	32	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1620	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	31	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1728	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	30	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1728	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	29	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1728	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	28	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:02:38 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	27	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:07 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	26	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:05 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	25	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1668	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	24	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	23	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	22	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1668	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	21	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1668	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	20	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1944	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:41:55 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	19	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1944	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:41:55 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	18	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1944	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:41:55 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	17	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:35:49 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	16	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	15	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	14	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	13	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	12	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	11	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	10	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:58 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	9	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1712	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 9:01:42 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	8	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1712	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 9:01:42 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1712	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 9:01:42 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	6	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1704	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:21 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	5	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1704	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:21 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	4	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1704	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:21 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1684	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:14 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	2	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1684	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:14 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1684	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:14 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]